Automate the workstation setup to make everything works at day one. Migrate to a new device fast. Make it easy to follow your standard within a company. Improve security by reviewing what you install.
The user selects different roles e.g., design vs programmer / work vs private. The script runs on mac. The script can setup the dotfiles, system configurations, binaries and the app store. The setup makes the preferred behavior easy but people can extend it.
Use a bash script that includes the default setup. Prevent manual installation through device management. Allow the employees to create pull request to the script to add software. Review the pull request and then make them available to everyone.
- In lower risk environments go for an "add software by yourself and it gets pushed to your device and we only verify it later".